Donor FAQs

• Audit Basics
  • What is a Management Letter?
  • What is the responsibility of the auditors?
• Types of services available to Donors
  • When should we require a special purpose audit?
• Selecting Appropriate Auditors
  • How can donors determine that an audit firm adheres to international standards?
  • How can donors determine that an audit firm adheres to international standards?
  • What should Donors include in its grant agreement with an MFI?
• After the Audit
  • What should we do if the audit is qualified?
  • What do we look for in the notes to the financials?
  • What should an MFI audit review consultant do?
• Recommended Disclosure Guidelines
  • How can donors use the guidelines?
  • What if the MFI does not comply?

Audit Basics

Almost all businesses can benefit from having an independent person or firm reviewing their activities. An external audit is one such type of review. MFIs that are using public funds whether in the form of public savings, loans from banks, or donor disbursements need an external audit of their financial statements to confirm the proper reporting of these funds.

Obtaining good quality MFI audits has proven rather challenging for several reasons related to both the MFIs and auditors. MFIs because they often have incomplete or non-existant terms of reference for the audits, poor preparation, and little understanding of how to gain value from and audit, for example. Auditors because they often do not take the time to recognize the unique requirements of an MFI audit. The experience internationally has been mixed with the quality of most MFI audits being weak.

MFI donor expectations of an external audit frequently do not correspond with the results of an external audit. Specifically, an audit will not prevent or detect all instances of fraud, nor report on the funds one donor has granted to the MFI. Auditors will instead consider the internal control structure in their audits (which could identify areas where fraud may occur), as well as aggregate all donor funds and report on the institution as a whole.

There are many types of audits that can be performed by external auditors including financial, operational, and management audits, special purpose audits, agreed-upon procedures, reviews, and compilations.

An external financial audit is a critical tool for MFI managers, donors, and investors because it provides a professional, independent opinion on the financial position of the MFIs.

The auditor output of an external financial audit will always be an audit opinion on the financial statements prepared by MFI management. Additionally, an optional, though highly recommended output is a management letter which identifies weaknesses in internal control systems observed during the audit.

To address the uniqueness of MFIs, CGAP is developing a set of disclosure guidelines () which will require certain pertinent MFI specific information to be included in the notes to the financial statements.

In order to gain full benefit from external audits it is important that MFI management understand the audit process (), the outputs of an audit, and what to do with those outputs.

For small MFIs it may be preferable for them to set as a priority the strengthening of their internal control systems and management information systems rather than depleting scarce resources in contracting a poor quality audit.

What is a Management Letter?

Traditionally, a management letter was a required piece of correspondence between the auditor and the audited business, generated when the auditor detected significant internal control weaknesses while conducting the external audit. However, in practice, the management letter discloses not only significant internal control weaknesses, but also operational weaknesses. These might include issues relating to the loan portfolio, policies and procedures, MIS or any other area of MFI operations. They might also simply offer suggestions to assist management in fulfilling their responsibilities.

The management letter is no longer a "required" output and to get one, an MFI must request it in its TOR for the audit. Donors should prompt MFIs to obtain management letters with each audit. The audit firm should be instructed in the TOR to include a management letter that specifically addresses the unique issues of the MFI.

The management letter is intended as a direct written dialog between the auditors and the board and management of the MFI. Thus, a complete and sufficient management letter is structured in such a way that for each item there should be:

• a comment on the finding, then
• corrective suggestions from the auditors, and finally
• a statement by management on how it will (or will not) address the issue

Because the interchange is intended to be frank, the management letter generally is not distributed outside the institution. Donors requiring the management letter should include notice of that requirement in the grant agreement. They should recognize that the candid interchange between auditor and MFI might be diluted by the need to distribute the report.

Donors who do review MFI management letters should recognize that often the severity of the findings are not differentiated in the management letter and that it is up to the reader to assess the relative level of importance of each. Additionally, management letters continue to come from auditors who have limited knowledge of the microfinance business, and thus some of their recommendations may have limited utility. Note that the relevance and depth of the findings in the management letter are good indicators of the quality of the audit, the auditor, and the amount of preparation conducted before the audit.

Donors should use the management letter as a tool to work with an MFI on correcting identified weaknesses. Do not use it as a stick to punish them.

Click the document icon to see an illustrative management letter ()

What is the responsibility of the auditors?

The auditor's responsibility is to complete the terms of reference in an independent manner. In the case of a financial audit they must apply auditing standards, preferably International Standards on Auditing developed by the International Auditing Practices Committee (), to determine if the MFI is accounting for, and presenting, financial information in accordance with the generally accepted accounting principles of the nation where the institution does business, or preferably with International Accounting Standards where possible.

International Standards on Auditing (ISA) govern what and how the auditor conducts their work, while International Accounting Standards (IAS) govern how the business treats financial transactions.

National or international standards on auditing control the quality of the external auditor's work. They provide guidance regarding the nature of the relationship between auditor and client, the planning and execution of the audit, and the reporting on audit findings, among other things.

Many countries maintain their own generally accepted accounting principles developed to respond to the domestic needs of the accounting industry and governments. However, because MFIs are frequently working with international partners (donors, parent companies) and report internationally, it is preferable, where possible, to contract audits that are conducted under the guidance of ISA.

Types of services available to Donors

External auditors perform many audit services beyond simply the annual financial audit. These include special purpose audits, agreed-upon procedures, reviews,compilations, and fraud investigations. Each is used for different specific purposes and all can be resources for donors.

Donors may require an expense verification (a type of special purpose audit) to periodically confirm actual expenditures against a donor approved grant budget. Some donors have special audits that are required of every grantee, like USA Federal Grantees who must contract an A-133 audit which is mostly comprised of a funds accountability statement for US government funds. These audits are additional to the annual financial audit.

Depending on the flexibility of donor agreements with MFIs, there are many options for donors to utilize audit services to oversee their investment in an MFI. These should be limited to only what is truly necessary for investment monitoring or in response to MFI needs. Where possible these should be coordinated with other donor requirements to minimize the costs (direct and opportunity) of MFIs enduring audits beyond the annual financial audit.

An illustrative TOR () for a financial audit has been developed by CGAP and is available for download.

When should we require a special purpose audit?

Special purpose audits (or agreed upon procedure audits) occur when the donor or MFI needs a specific opinion regarding either a set of transactions or certain group of assets.

Several special purpose audits by donors are relatively common. Some examples include:

• Investigation of loan portfolio quality where the donor contracts an auditor to confirm the portfolio quality reported by the MFI when the integrity of these reports is in doubt.
• Fraud investigations where a donor contracts an audit firm to investigate allegations or evidence of fraud related to their funds
• Expense verifications where donors contract an audit firm to frequently (often quarterly) verify the expenses paid from their funds prior to subsequent disbursement.

Selecting Appropriate Auditors

The board of directors is the ultimate governing body of most MFIs and is thus responsible for commissioning () and overseeing the external audit. The external auditor is usually engaged by-and ultimately responsible to-the board of directors (though often approved by the Annual General Meeting, and overseen by the Board's Audit Committee). Ensuring that clear terms of reference are developed and that the most qualified auditors are selected are among the board's key responsibilities.

Occasionally, the external auditor will also have a contractual or fiduciary relationship with an outside stakeholder such as a donor, or other investor.

Donors could be involved with auditor selection on two levels. The first is their own direct selection of an auditor to review specific issues with an MFI (for example, special purpose and compliance audits). The second is in support of their investee's boards, helping them to ensure that they are obtaining audits that are prepared by qualified auditors using international standards.

To satisfy both of these needs donors could assess the reputation, financial services experience, supervisory opinions of the firm, their commitment to following international standards, and the quality of individual staff within the audit firm.

Developing, maintaining, and disseminating a list of pre-approved auditors could aid MFIs in narrowing their search for quality audit firms. However, donors might remain somewhat flexible to MFIs that can make a good argument in support of a firm that is not represented on the list.

Through their investee MFIs, donors have the potential to gain significant knowledge about the quality of the different audit firms in their market. It can be extraordinarily helpful for donors to share their information about individual audit firms among themselves. This can have a powerful impact in getting auditors to improve the quality of their MFI audits.

It is easy for an MFI to obtain an audit firm that provides an unqualified audit. Donors should assess the available firms based on recognized criteria and require their investees to follow donor standards in selection of an audit firm. This is a reasonable requirement for an investment in the MFI.

In developing the parameters for auditor selection, a donor must recognize that not all MFIs can afford international audit firms. Good MFIs audits take time to execute, and can be expensive. Donors can help MFIs identify quality local auditing firms to keep costs down.

In order to help MFIs gain access to better audits without having to use expensive international firms, donors may decide to develop an efficient mechanism for improving the quality of local external auditors. CGAP is interested in working with such donors.

How can donors determine that an audit firm adheres to international standards?

Donors can use several methods to help determine if an audit firm adheres to international standards on auditing. These may include:

• Queries to other donors who have used the firm in question and know its reputation
• Review of audit reports prepared by the audit firm in question
• Inquire of the licensing body () in a particular country
• Review memberships of the firm in international auditing bodies.
• Review the firm capability statement that most audit firms produce for marketing purposes. These are frequently attached to proposals from an audit firm.

How can donors determine that an audit firm adheres to international standards?

Donors can use several methods to help determine if an audit firm adheres to international standards on auditing. These may include:

• Queries to other donors who have used the firm in question and know its reputation
• Review of audit reports prepared by the audit firm in question
• Inquire of the licensing body () in a particular country
• Review memberships of the firm in international auditing bodies.
• Review the firm capability statement that most audit firms produce for marketing purposes. These are frequently attached to proposals from an audit firm.

What should Donors include in its grant agreement with an MFI?

The first key is to ensure that the grant agreement with the MFI stipulates audit related issues that might be important to the specific donor. Some of these include:

• Receiving a draft copy of the TOR (), possibly with the opportunity to comment on it.
• Understanding on which basis the local audit firm will be chosen. This could include the process for competitive bidding, the price criteria, and record of accomplishment, among others.
• Conducting audits following International Standards on Auditing wherever possible.
• Making available a copy of the Management letter ().
• Making Audit reports () available to the donors within 150 days of the end of the fiscal year.
• For a performance based contract, specifying that performance targets will be based on audited figures
• Complience with the CGAP's financial statement disclosure guidelines ()

After the Audit

With financial audits, a donor should require a copy of both the audit report, and the financial statements with their notes, as well as a copy of the management letter with management's responses.

Normally, the management letter () is not made available to outside parties, but significant donors should review these carefully. This tool will show the donor/investor specifically where the institution is experiencing control weaknesses.

It is recommended that Donors consider doing the following:

1. Check the audit opinion to confirm it is unqualified. If it is qualified, follow up with the MFI board and management.
2. Check for discrepancies between the information reported by the MFI to the donor and the audited reports. Any significant differences should be investigated until the donor is confident that they understand the reasons.
3. Review audit reports should be reviewed for trends, both positive and negative. Investigate significant changes in those trends.
4. Review the management letter. Determine the significance of the points raised, and review the MFI's response to prior points raised. Significant issues and lackluster responses should lead to donor investigation.

What should we do if the audit is qualified?

Audits are qualified for many reasons, some more alarming than others. If the audit is qualified for a "scope limitation" this means that the auditors were prevented from performing all the tests they wanted to perform. This is one of the more alarming situations, as most "scope limitation" qualifications can be avoided.

Donors should realize that due to inadequate records, or a non-existent management information system, MFIs may experience a qualified audit, especially the first time that they are audited.

Donors should follow up with the MFI and optimally, the external auditor in a conference situation where the reason for the qualification is discussed and how it may be removed in the future. A qualified audit shouldn't cut off donor funding until a complete understanding of the situation has been assessed. It is up to the donor to determine if the qualified audit is a significant event to restrict or curtail future funding.

What do we look for in the notes to the financials?

As is often stated in the audited financial statements, the notes are an integral part of the statements. Without them, the reader can not be informed fully of the details of the statements. One should carefully read all the notes to the financials. This is where an institution explains the methods it uses, and where they point out unique issues relating to their financials. Important details relating to financial statement presentations of loans, deposits, grants, borrowings, capital are provided in the notes. These include special transactions; account flows during the year, and changes in values where appropriate. Also, the notes should be reflective of the CGAP Disclosure Guidelines () which will help the MFI to present important MFI specific data to help reader understand the MFI business of the organisation.

Among the important notes that all should review include:

• Notes to the loan portfolio
  • Review the change in the value of the loan portfolio. One should see a beginning balance, loans disbursed, loans repaid, loans written off, and an ending balance. The loans written off amount is a critical number for review.
  • The transaction flow of the reserve for possible loan losses showing additions and write-offs. One should be concerned with sharp increases or decreases of the reserve as a percentage of average portfolio over time.
  • Review the table noting the structure of delinquent accounts. This will indicate any problems with the portfolio quality that may not be reflected in the balance sheet. This table will also note restructured loans. MFIs will often restructure delinquent loans in order not to write them off when these are actually lost loans. Restructured loans should be zero, or very small (less than 0.1% of the outstanding portfolio) unless there is a problem with the portfolio.
  • Note the institution's policy on reserves and write-offs (). See the help desk question "What are accepted norms for Provisioning against possible loan losses" for a comparison of reserve policies among several different MFI related entities.
• Notes on cash and (non-credit) investments
  • This will help to understand the cash management activities of management. Efficient and effective cash management is a sign of good management.
• Notes on changes in fixed assets
  • Review to understand better the utilization of funding for the organisation. This table will note additions, depreciation, and disposals by type of asset. Unusual additions or disposals, or very rapid or slow depreciation may indicate issues.
• Notes to the fund balance
  • Review the details of other donor contributions
  • Note the trend of the fund balance
  • Note the cumulative amount of all donations received (where available) and assess this against the size of the MFI in terms of loans outstanding and total assets.
• Notes on Savings
  • Review how savings are utilized
• Notes relating to legal actions pending
  • To identify legal problems the institution has with government, staff, clients, or others that might have a significant impact on the MFI

What should an MFI audit review consultant do?

Donors should consider contracting a consultant (or an appropriately skilled person within the donor's office) to evaluate external audits of MFIs on several broad criteria including:

Overall audit management: How well did the audit go between the audit firm and the MFI? Was the report submitted on time and on budget? Were budget overages explained?

Results of the audit: Is the audit report useful? Does it contain information for further analysis? Does it appear that the audit firm knew what they were doing, or did they overlay a bank or non-profit audit template over the MFI?

Analysis of the MFI: How is the MFI doing financially? Are costs and revenues in line with established budgets and projections? Are there good reasons for significant differences? Does it look as if the MFI will reach / maintain / improve self-sufficiency?

Areas of concern: Is the MFI branching into other activities besides credit (business training, health education, etc.)? Is the audit qualified for a scope limitation? Are the management letter issues significant?

Other areas: Who are the other donors to the MFI and what is known about them? What issues should we be watching for concerning the MFI management and operations?

Consultants can also be utilized in the audit process in many areas including:

• Selecting the local audit firm and designing the TOR specifically for agreed upon procedures such as the loan portfolio review
• Providing technical assistance to local audit firms especially in support of the two critical phases of audit planning and the audit opinion
• Audit quality control (if the consultants has access to the audit schedules and working papers)
• Review of the audit report and findings, analyzing discrepancies between the MFI reports and the audit reports, assessing the significance of the issues in the management letter, working with the MFI on internal audit follow up, to name just a few.

Recommended Disclosure Guidelines

Most MFIs are unusual institutions: they use a financial business to pursue a social mission that is often supported-at least temporarily-by grants or soft loans. In addition, MFIs tend to use lending practices that are much different from those of conventional banks. Because of such special characteristics, assessing an MFI's financial condition requires some information that conventional businesses do not report-for instance, information about in-kind subsidies, the delinquency status of the loan portfolio, or other items not required under International Accounting Standards (IAS) ().

To help address this problem, CGAP is developing a set of disclosure guidelines to help MFIs and auditors ensure that the presentation of MFI information is comprehensive enough to aid in an adequate assessment of an MFI by external readers.

These guidelines () are not accounting standards. They simply call for reporting of certain critical information and do not direct the choice of an accounting method.

The disclosures are the responsibility of the MFI and generally relate to information that an auditor requires anyway in order to render an informed decision.

When finalized, MFI auditors should require fulfillment of these disclosures and ensure that they are included in the notes to the financial statements. Auditors should report the MFI's level of compliance within the audit opinion letter, where possible.

Donors are encouraged to request the use of these draft guidelines and to consider mailing to CGAP a copy each of the TOR, the audited financial statements, and comments about their experience in applying the guidelines. This will assist CGAP in finalizing relevant disclosure guidelines.

How can donors use the guidelines?

Donors could become familiar with the CGAP disclosure guidelines and weave some of the more important requirements (regarding loan loss reserve and loan loss provisioning, for example) into the periodic reporting from their MFI partners. If the MFI is accustomed to preparing reports for the donor based on these disclosures on a periodic basis, it should not be hard for the MFI to prepare a report for inclusion in the audited financial statements.

Getting partner MFIs to use the guidelines in their audits should assist auditors in addressing the specific issues that are make MFIs unique, and this should result in a materially better audit, and better information for the donor to use in assessing their investments.

The disclosure of these issues should provide an additional incentive for the board of directors to address them.

Finally, the disclosures should aid in the ability of donors to compare results of one MFI to those of another. This will help to recognize where specific assistance might be appropriate, and provide the potential for a better understanding of the operations of each institution while improving comparability.

What if the MFI does not comply?

Generally, donors should review the disclosure guidelines and decide if they wish to require compliance with them as part of their MFI grant agreements. Without some prompting by donors, MFIs (like any business) are unlikely to offer additional detailed information about their operations.

For those MFIs that already have signed agreements, the donor could request compliance with the new guidelines. Donors can provide them with the disclosure guidelines (), and note the benefits to the institution from such disclosure. Working with other donors to get all MFIs participating as soon as they sign their next agreement could prove dramatically effective.

For those that continue to refuse to comply, the donor could determine why the MFI would not comply with the request to follow the CGAP disclosure guidelines. An understanding of the reason for non-compliance might be helpful as such refusal may indicate hidden problems within the MFI. Typically, well managed MFIs should want the information presented in the disclosure guidelines as management information for decision making. CGAP welcomes comments on the usefulness of the guidelines.